[clamav-users] How often can I run cvdupdate?

[G.W. Haywood]

Hi there,

On Wed, 25 May 2022, Orion Poplawski via clamav-users wrote:

> We're starting to run clamav on more local hosts and were starting to see 
> rate limiting messages.  So I've setup a local private mirror with cvdupdate 
> ... I'm starting to see warnings like:
>
> Received signal: wake up
> ClamAV update process started at Wed May 25 07:26:29 2022
> daily database available for update (local version: 26551, remote version: 
> 26552)
> WARNING: downloadFile: file not found: https://MIRROR/daily-26552.cdiff
> WARNING: downloadPatch: Can't download daily-26552.cdiff from https://MIRROR/daily-26552.cdiff

If it were my choice I'd probably use freshclam rather than cvdupdate,
partly because the docs [1] somewhat discourage use of cvdupdate, partly
because Pypi is a can of worms I wouldn't then have to worry about,

> I'm running cvdupdate at the recommended 4 hour interval.  Can I run it more 
> often?

The Pypi site uses 4 hours as an example, but I'm not sure that's
exactly a recommendation.  Over at docs.clamav.net [1] it says

[quote]

Now run this as often as you need, or at least once a day to download/update the databases:

cvd update

[/quote]

Since it's just using DNS requests to check for updates it's very
lightweight.  I feel sure you can make the queries as often as you
think is reasonable, but do bear in mind that updates to the official
signature database aren't especially frequent - a couple of times a
day or thereabouts at most I think.

> ... I may just have to exclude these types of warnings from logwatch.

I don't think I'd hide them.  I'd just ignore them when I saw them,
but at least they'd usefully tell me that something was happening.
Of course it depends on how many you'd get. :/

[1] https://docs.clamav.net/appendix/CvdPrivateMirror.html?highlight=cvdupdate#private-local-mirrors

-- 

73,
Ged.